DOCSLIB.ORG

Surveying the Landscape of Actionscript Security

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Surveying the Landscape of Actionscript Security SURVEYING THE LANDSCAPE OF ACTIONSCRIPT SECURITY TRENDS AND THREATS by Dhiraj V. Karamchandani APPROVED BY SUPERVISORY COMMITTEE: Kevin W. Hamlen, Chair Balaji Raghavachari Bhavani Thuraisingham Copyright c 2013 Dhiraj V. Karamchandani All rights reserved This thesis is dedicated to my advisor Dr. Kevin W. Hamlen in whose eyes I read the definition of the term ‘research’, and to my dearest family members who have instilled in me the invaluable virtue of selflessness. SURVEYING THE LANDSCAPE OF ACTIONSCRIPT SECURITY TRENDS AND THREATS by DHIRAJ V. KARAMCHANDANI, BE THESIS Presented to the Faculty of The University of Texas at Dallas in Partial Fulfillment of the Requirements for the Degree of MASTER OF SCIENCE IN COMPUTER SCIENCE THE UNIVERSITY OF TEXAS AT DALLAS December 2013 ACKNOWLEDGMENTS The text of this thesis incorporates and extends joint work with Meera Sridhar and Dr. Kevin W. Hamlen, which has been submitted for publication and is currently under review. The author thanks both co-authors for their contributions to the study. This work was supported in part by the National Science Foundation under award #1065216. All opinions, findings, conclusions, or recommendations expressed are those of the author(s) and do not necessarily reflect those of the National Science Foundation. November 2013 v PREFACE This thesis was produced in accordance with guidelines which permit the inclusion as part of the thesis the text of an original paper or papers submitted for publication. The thesis must still conform to all other requirements explained in the “Guide for the Preparation of Master’s Theses and Doctoral Dissertations at The University of Texas at Dallas.” It must include a comprehensive abstract, a full introduction and literature review, and a final overall conclusion. Additional material (procedural and design data as well as descriptions of equipment) must be provided in sufficient detail to allow a clear and precise judgment to be made of the importance and originality of the research reported. It is acceptable for this thesis to include as chapters authentic copies of papers already published, provided these meet type size, margin, and legibility requirements. In such cases, connecting texts which provide logical bridges between different manuscripts are mandatory. Where the student is not the sole author of a manuscript, the student is required to make an explicit statement in the introductory material to that manuscript describing the student’s contribution to the work and acknowledging the contribution of the other author(s). The signatures of the Supervising Committee which precede all other material in the thesis attest to the accuracy of this statement. vi SURVEYING THE LANDSCAPE OF ACTIONSCRIPT SECURITY TRENDS AND THREATS Publication No. Dhiraj V. Karamchandani, MS The University of Texas at Dallas, 2013 Supervising Professor: Kevin W. Hamlen As one of the foremost scripting languages of the World Wide Web, Adobe’s ActionScript Flash platform now powers multimedia features for a significant percentage of all web sites. However, its popularity and complexity have also made it an attractive vehicle for myriad malware attacks over the past five years. Despite the perniciousness and severity of these threats, ActionScript has been relatively less studied in the scholarly security literature. To fill this void and stimulate future research, this thesis presents a systematic study of Flash security threats and trends, including an in-depth taxonomy of fifteen major Flash vulnerability and attack categories, a detailed investigation of 520 Common Vulnerability and Exposure (CVE) articles reported between 2008–2013, and an examination of what makes Flash security challenges unique. The results of these analyses provide researchers, web developers, and security analysts a better sense of this important attack space, and identify the need for stronger security practices and defenses for protecting users of these technologies. vii TABLE OF CONTENTS ACKNOWLEDGMENTS . v PREFACE . vi ABSTRACT . vii LIST OF FIGURES . x LIST OF TABLES . xi CHAPTER 1 INTRODUCTION . 1 CHAPTER 2 A TAXONOMY OF VULNERABILITIES AND ATTACKS . 5 2.1 Flash-based Phishing . .5 2.2 Flash-based Pharming and DNS Rebinding . .7 2.2.1 Flash-Based Pharming . .7 2.2.2 DNS Rebinding . .7 2.3 Flash-based Drive-by-Download and Drive-by-Cache . .8 2.4 Same-Origin Policy Abuse . 10 2.4.1 Same-origin Policy . 10 2.4.2 Case-study: Client-side Flash Proxies . 11 2.5 Attacks using ExternalInterface, URLRequest, and navigateToURL . 13 2.5.1 ExternalInterface Abuse . 13 2.5.2 URLRequest and navigateToURL Abuse . 14 2.6 Flash-based Cross-Site Scripting (XSS) . 15 2.7 Flash-based Cross-Site Request Forgery (CSRF) . 16 2.8 Flash-based Heap Spraying . 17 2.9 Flash-based JIT Spraying . 19 2.10 Obfuscation . 20 2.11 Type Confusion Exploitation . 22 2.12 Vulnerabilities in Flash Parser and Analysis Tools . 23 viii 2.13 JavaScript and HTML Script Injection . 25 2.14 Flash Parameter Injection . 26 2.15 Flash-based Malvertisements . 29 CHAPTER 3 ANALYSIS . 32 3.1 Scientic Research Survey Methodology . 32 3.2 CVE Collection and Investigation . 33 3.2.1 Total Flash-relevant CVEs Over the Years . 33 3.2.2 Flash-relevant Attack/Vulnerbility Trend Evolution Over the Years . 33 3.3 Classification Challenges . 36 3.3.1 Example 1: CVE-2013-0634 . 36 3.3.2 Example 2: CVE-2011-2836 . 36 3.3.3 Example 3: CVE-2011-0627 . 39 3.3.4 Example 4: CVE-2011-0578 . 40 3.3.5 Example 5: CVE-2012-3414 . 41 3.3.6 Example 6: CVE-2012-2399 . 41 3.3.7 Example 7: CVE-2012-3415 . 42 CHAPTER 4 RELATED SURVEYS . 46 CHAPTER 5 CONCLUSION AND FUTURE WORK . 47 REFERENCES . 48 VITA ix LIST OF FIGURES 2.1 Potentially dangerous ActionScript classes, methods, and properties . 16 2.2 HTML code with injection of Flash parameters using the Embedded URI method 27 3.1 Flash presence in the top six security publication venues in 2008–2013. 33 3.2 Number of Flash-relevant CVEs by Year from 2008–2013. 34 3.3 Evolution of Flash-relevant vulnerabilities and attacks between 2008-2013. 37 3.4 Evolution of Flash-relevant vulnerabilities and attacks between 2008-2013, in- cluding inferences. 38 3.5 Text of CVE-2013-0634 . 39 3.6 Text of CVE-2011-2836 . 39 3.7 Text of CVE-2011-0627 . 40 3.8 Text of CVE-2011-0578 . 41 3.9 Text of CVE-2012-3414 . 41 3.10 Text of CVE-2012-2399 . 42 3.11 Text of CVE-2012-3415 . 42 x LIST OF TABLES 3.1 CVE Classification Legend . 35 3.2 CWE Cross Section Mapped into by NVD [75]. 43 xi CHAPTER 1 INTRODUCTION Adobe Flash applets (Shockwave Flash programs) provide web developers a superior platform for creating rich, dynamic web content such as web advertisements, online games, streaming media and interactive webpage animations, resulting in a soaring popularity of the technology on the web. Additionally, most of this content can also be made available to the desktop using the Adobe Integrated Runtime (AIR) cross-platform environment. The following statistics [7, 99] demonstrate the pervasive impact of Flash. More than 20,000 apps in mobile app stores such as Apple App Store and Google Play are created using Flash. A staggering revenue of over US$70 million per month is generated by the top nine Flash enabled games in China. Flash is used in 24 of top 25 Facebook games. Flash is the choice of technology of more than three million developers for creating interactive and animated web environments. Flash is used by 16.9% of all websites. The popularity of Flash combined with the complexity of its features has made it ex- tremely attractive to attackers. The 2013 Cisco Annual Threat Report marks Adobe Flash as the third highest in the top content types for malware distribution [20]. The 2013 Symantec Internet Security Threat Report mentions that of all plug-in vulnerabilities between 2010 and 2012, Adobe Flash Player constitutes 18%, 20%, and 22% in the years 2010, 2011, and 2012 respectively. Flash-powered attacks have successfully penetrated some of the most security- hardened facilities in the world, such as the famous 2011 penetration of RSA [68], and the massive Luckycat campaign that targeted an entire spectrum of important U.S. industries such as aerospace, energy, engineering, shipping, and military research, as well as top-level international organizations such as Indian military research institutions, and groups in Japan and Tibet [48]. 1 2 One reason Flash security is so non-trivial is because of the feature-filled complexity of the ActionScript bytecode language [6], which Flash uses internally. Like other ECMAScript languages, ActionScript includes language features such as an object model, function calls, class inheritance, compile time and run-time type checking, packages, namespaces, regular expressions, and direct access to security-relevant system resources [3]. However, unlike JavaScript, ActionScript programs are disseminated as compiled binary Flash files (.swf files) that pack images, sounds, text, and bytecode in a webpage-embeddable form, which is then seamlessly JIT-compiled and/or interpreted by the Adobe Flash Player browser plug-in when the page is viewed. This transparent purveyance of powerful binary content from Flash authors, through page publishers, to end-users educes many security threats. Security apprehensions have been further exacerbated due to the recent trend of web environments becoming aggressively heterogeneous (e.g., composed of mash-ups that mix mobile code from many mutually distrusting sources), which expand the attack vulnerability surface area. Additionally, Flash’s deployment as plug-in VM tends to widen threat windows due to patch lag. Newly discovered VM vulnerabilities are typically resolved by patches released by Adobe, but many consumers are apathetic or inattentive in downloading and installing the patches; in many large companies, older versions of the Flash plug-ins may be required for compatibility with critical business systems, creating reluctance in updating to the latest version.
Load more

Recommended publications
  • Cross-Platform System of Medical Documents Protection Through Digital Signatures
    CROSS-PLATFORM SYSTEM OF MEDICAL DOCUMENTS PROTECTION THROUGH DIGITAL SIGNATURES Fernando Guilherme Ferreira Sousa Project/Dissertation developed under supervising of José Magalhães Cruz (PhD) in Glintt - Healthcare Solutions, S.A. 1. Motivation documents, which are then sent to the server and, consequently, validated and stored in the database. Due to the extreme information sensibility in the Subsequent to this process, each time a document is health area, it is really necessary to be absolutely sure opened to be viewed, for example, a check is made of about who performs certain medical transactions. It a possible change to the same document, in order to must have permission and authority to do so, i.e. be ensure that recurrently its integrity. Through really the right person to do this transaction. In areas cryptography-based security methods of public keys, involving health treatments, marking of exams or it is verified if someone tampered the document or even surgeries and new prescriptions, there must be made it invalid in some way. an extremely effective control to verify effectively that all transactions must be properly carried out, Each platform that the doctor use should read his without any type of deception or illegality. digital certificate, which is contained in a Smart Card and is installed on the machine, once inserted in a One of the biggest motivations is that the patient, in suitable card reader. Then, the digital signature is the future, might be aware that there is a control in performed with the certificate’s associated private the preparation of their medical documents. All key, which certificates the medical document.
    [Show full text]
  • ACCESSING DATA with FLEX 2 Accessing Data Services Overview
    Accessing Data with ADOBE® FLEX® 4.6 Legal notices Legal notices For legal notices, see http://help.adobe.com/en_US/legalnotices/index.html. Last updated 12/3/2012 iii Contents Chapter 1: Accessing data services overview Data access in Flex compared to other technologies . 1 Using Flash Builder to access data services . 3 Data access components . 4 Chapter 2: Building data-centric applications with Flash Builder Creating a Flex project to access data services . 7 Connecting to data services . 8 Installing Zend Framework . 19 Using a single server instance . 21 Building the client application . 21 Configuring data types for data service operations . 25 Testing service operations . 29 Managing the access of data from the server . 29 Flash Builder code generation for client applications . 33 Deploying applications that access data services . 39 Chapter 3: Implementing services for data-centric applications Action Message Format (AMF) . 43 Client-side and server-side typing . 43 Implementing ColdFusion services . 43 Implementing PHP services . 50 Debugging remote services . 61 Example implementing services from multiple sources . 64 Chapter 4: Accessing server-side data Using HTTPService components . 71 Using WebService components . 80 Using RemoteObject components . 97 Explicit parameter passing and parameter binding . 113 Handling service results . 121 Last updated 12/3/2012 1 Chapter 1: Accessing data services overview Data access in Flex compared to other technologies The way that Flex works with data sources and data is different from applications that use HTML for their user interface. Client-side processing and server-side processing Unlike a set of HTML templates created using JSPs and servlets, ASP, PHP, or CFML, Flex separates client code from server code.
    [Show full text]
  • Enterprise Development with Flex
    Enterprise Development with Flex Enterprise Development with Flex Yakov Fain, Victor Rasputnis, and Anatole Tartakovsky Beijing • Cambridge • Farnham • Köln • Sebastopol • Taipei • Tokyo Enterprise Development with Flex by Yakov Fain, Victor Rasputnis, and Anatole Tartakovsky Copyright © 2010 Yakov Fain, Victor Rasputnis, and Anatole Tartakovsky.. All rights reserved. Printed in the United States of America. Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472. O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (http://my.safaribooksonline.com). For more information, contact our corporate/institutional sales department: (800) 998-9938 or [email protected]. Editor: Mary E. Treseler Indexer: Ellen Troutman Development Editor: Linda Laflamme Cover Designer: Karen Montgomery Production Editor: Adam Zaremba Interior Designer: David Futato Copyeditor: Nancy Kotary Illustrator: Robert Romano Proofreader: Sada Preisch Printing History: March 2010: First Edition. Nutshell Handbook, the Nutshell Handbook logo, and the O’Reilly logo are registered trademarks of O’Reilly Media, Inc. Enterprise Development with Flex, the image of red-crested wood-quails, and related trade dress are trademarks of O’Reilly Media, Inc. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and O’Reilly Media, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps. While every precaution has been taken in the preparation of this book, the publisher and authors assume no responsibility for errors or omissions, or for damages resulting from the use of the information con- tained herein.
    [Show full text]
  • Applets, Servlets and JSP
    Java Programming : applets, servlets and JSP. SR03 Dritan Nace A summary of Java Java is a language developed by Sun, which is designed to be object oriented and Simple, robust and secure, independent of hardware architectures and Multitasking. Object oriented and simple : Simpler than C++, transparent memory managment… Robust et secure : Data typing is extremely strict. For applets, it is in principle impossible to access the resources of the host machine. Independant of hardware architectures : The compiler generates a universal code : the « byte-code ». An interpreter which is specific to the host machine, « virtual machine », executes the programs. Multitasking : Java seemingly allows execution of several processes. In reality, a time slot is given to each process on the processor (Multithreaded). J2SE versus J2EE J2SE (standard edition) contains the basic usable components from both the client and server side, – GUI, AWT/Swing for applications (client) or applets. Currently J2SE v1.6 (ou V6) J2EE (enterprise edition), is in a certain sense an extension of SE, designed for server side programming – Servlets, JSP, EJB, etc. • Currently J2EE v1.4 Java and object oriented programming • Classes, and objects – The objects include data and processing for the data. Communication is done via messages (methods). – A class corresponds to an abstract model for object construction. A class is made up of: • attributes (static part) • Methods (dynamic part), which define the behaviour. – Inheritance : the « is a » relationship : a car is a vehicule, – Polymorphism : the same message can be recognised by several objects and entail different behaviour. Portability: JVM The compiler compiles the java source in byte code : javac car.java => car.class Then, java is the name of the program which will interpret the generated byte code.
    [Show full text]
  • Abstract Window Toolkit Overview
    In this chapter: • Components • Peers 1 • Layouts • Containers • And the Rest • Summary Abstract Window Toolkit Overview For years, programmers have had to go through the hassles of porting software from BSD-based UNIX to System V Release 4–based UNIX, from OpenWindows to Motif, from PC to UNIX to Macintosh (or some combination thereof), and between various other alternatives, too numerous to mention. Getting an applica- tion to work was only part of the problem; you also had to port it to all the plat- forms you supported, which often took more time than the development effort itself. In the UNIX world, standards like POSIX and X made it easier to move appli- cations between different UNIX platforms. But they only solved part of the prob- lem and didn’t provide any help with the PC world. Portability became even more important as the Internet grew. The goal was clear: wouldn’t it be great if you could just move applications between different operating environments without worr yingabout the software breaking because of a different operating system, win- dowing environment, or internal data representation? In the spring of 1995, Sun Microsystems announced Java, which claimed to solve this dilemma. What started out as a dancing penguin (or Star Trek communicator) named Duke on remote controls for interactive television has become a new paradigm for programming on the Internet. With Java, you can create a program on one platform and deliver the compilation output (byte-codes/class files) to ever yother supported environment without recompiling or worrying about the local windowing environment, word size, or byte order.
    [Show full text]
  • Apache Harmony Project Tim Ellison Geir Magnusson Jr
    The Apache Harmony Project Tim Ellison Geir Magnusson Jr. Apache Harmony Project http://harmony.apache.org TS-7820 2007 JavaOneSM Conference | Session TS-7820 | Goal of This Talk In the next 45 minutes you will... Learn about the motivations, current status, and future plans of the Apache Harmony project 2007 JavaOneSM Conference | Session TS-7820 | 2 Agenda Project History Development Model Modularity VM Interface How Are We Doing? Relevance in the Age of OpenJDK Summary 2007 JavaOneSM Conference | Session TS-7820 | 3 Agenda Project History Development Model Modularity VM Interface How Are We Doing? Relevance in the Age of OpenJDK Summary 2007 JavaOneSM Conference | Session TS-7820 | 4 Apache Harmony In the Beginning May 2005—founded in the Apache Incubator Primary Goals 1. Compatible, independent implementation of Java™ Platform, Standard Edition (Java SE platform) under the Apache License 2. Community-developed, modular architecture allowing sharing and independent innovation 3. Protect IP rights of ecosystem 2007 JavaOneSM Conference | Session TS-7820 | 5 Apache Harmony Early history: 2005 Broad community discussion • Technical issues • Legal and IP issues • Project governance issues Goal: Consolidation and Consensus 2007 JavaOneSM Conference | Session TS-7820 | 6 Early History Early history: 2005/2006 Initial Code Contributions • Three Virtual machines ● JCHEVM, BootVM, DRLVM • Class Libraries ● Core classes, VM interface, test cases ● Security, beans, regex, Swing, AWT ● RMI and math 2007 JavaOneSM Conference | Session TS-7820 |
    [Show full text]
  • Migrating from Java Applets to Plugin-Free Java Technologies
    Migrating from Java Applets to plugin-free Java technologies An Oracle White Paper January, 2016 Migrating from Java Applets to plugin-free Java technologies Migrating from Java Applets to plugin-free Java technologies Disclaimer The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle. Migrating from Java Applets to plugin-free Java technologies Executive Overview ........................................................................... 4 Browser Plugin Perspectives ............................................................. 4 Java Web Start .................................................................................. 5 Alternatives ....................................................................................... 6 Native Windows/OS X/Linux Installers ........................................... 6 Inverted Browser Control ............................................................... 7 Detecting Applets .............................................................................. 7 Migrating from Java Applets to plugin-free Java technologies Executive Overview With modern browser vendors working to restrict or reduce the support of plugins like
    [Show full text]
  • Installing Open Java Development Kit – Ojdkbuild for Windows
    Installing Open Java Development Kit – ojdkbuild for Windows © IZUM, 2019 IZUM, COBISS, COMARC, COBIB, COLIB, CONOR, SICRIS, E-CRIS are registered trademarks owned by IZUM. CONTENTS 1 Introduction ......................................................................................................... 1 2 OpenJDK distribution .......................................................................................... 1 3 Removing Oracle Java ......................................................................................... 2 4 Installing OJDK – 32bit or 64bit, IcedTea Java .................................................. 3 5 Installing the COBISS3 interface ........................................................................ 7 6 Launching the COBISS3 interface .................................................................... 11 7 COBISS3 interface as a trusted source in IcedTea ojdkbuild ........................... 11 © IZUM, 16. 7. 2019, VOS-NA-EN-380, V1.0 i VOS Installing Open Java Development Kit – ojdkbuild for Windows 1 Introduction At the end of 2018 Oracle announced a new business policy for Java SE which entered into force in April 2019. That is why when you install Java a notification and warning window appears. All versions of Java from 8 u201 onwards not intended for personal use are payable. For this reason, we suggest you do not update Java 8 to a newer version for work purposes. If you want a newer version of Java 8, install OpenJDK 8 and IcedTea. Also, do not install Java 8 on new computers (clients), but install OpenJDK 8 with IcedTea support. 2 OpenJDK distribution OpenJDK 1.8. build for Windows and Linux is available at the link https://github.com/ojdkbuild/ojdkbuild. There you will find versions for the installation. The newest version is always at the top, example from 7 May 2019: © IZUM, 16. 7. 2019, VOS-NA-EN-380, V1.0 1/11 Installing Open Java Development Kit – ojdkbuild for Windows VOS 3 Removing Oracle Java First remove the Oracle Java 1.8 software in Control Panel, Programs and Features.
    [Show full text]
  • Adobe RTMP Specification
    Copyright Adobe Systems Incorporated H. Parmar, Ed. M. Thornburgh, Ed. Adobe December 21, 2012 Adobe's Real Time Messaging Protocol Abstract This memo describes Adobe's Real Time Messaging Protocol (RTMP), an application-level protocol designed for multiplexing and packetizing multimedia transport streams (such as audio, video, and interactive content) over a suitable transport protocol (such as TCP). Table of Contents 1. Introduction . 3 1.1. Terminology . 3 2. Contributors . 3 3. Definitions . 3 4. Byte Order, Alignment, and Time Format . 5 5. RTMP Chunk Stream . 5 5.1. Message Format . 6 5.2. Handshake . 7 5.2.1. Handshake Sequence . 7 5.2.2. C0 and S0 Format . 7 5.2.3. C1 and S1 Format . 8 5.2.4. C2 and S2 Format . 8 5.2.5. Handshake Diagram . 10 5.3. Chunking . 11 5.3.1. Chunk Format . 11 5.3.1.1. Chunk Basic Header . 12 5.3.1.2. Chunk Message Header . 13 5.3.1.2.1. Type 0 . 14 5.3.1.2.2. Type 1 . 14 5.3.1.2.3. Type 2 . 15 5.3.1.2.4. Type 3 . 15 5.3.1.2.5. Common Header Fields . 15 5.3.1.3. Extended Timestamp . 16 5.3.2. Examples . 16 5.3.2.1. Example 1 . 16 5.3.2.2. Example 2 . 17 5.4. Protocol Control Messages . 18 5.4.1. Set Chunk Size (1) . 19 5.4.2. Abort Message (2) . 19 5.4.3. Acknowledgement (3) . 20 Parmar & Thornburgh [Page 1] Adobe RTMP December 2012 5.4.4.
    [Show full text]
  • Ajax Security Concerns
    Flash Security OWASP KC Meeting March 7, 2007 Rohini Sulatycki OWASP Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation http://www.owasp.org What is Flash? Adobe Flash is the authoring environment Rich Animation Video Action Script 2 FLA Flash Player is the VM that runs SWF byte codes OWASP 2 OWASP 3 What is Flash Remoting? Flash Remoting is a technology for HTTP-based request/response data communication. Supported natively by Flash Player Uses Action Message Format (AMF) for communication Modeled on SOAP Uses packet format OWASP 4 Flash Remoting Communication OWASP 5 Flash Remoting Communication OWASP 6 What is Flex 2? Flex is a framework for creating flash applications. Components Lists, Grids,.. Collection of technologies XML web services HTTP Flash Player ActionScript Flex applications are .swf files which you can then run in Flash Player. OWASP 7 Flash Shared Objects OWASP Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation http://www.owasp.org Shared Objects Similar to cookies Larger data storage 100KB Binary format No cross-domain access (by default) Not downloaded back to web server OWASP 9 Shared Objects Stored outside browser Do not get cleared when browser cache is cleared Accessible across browsers OWASP 10 SOL Editors C:\Documents and Settings\<USERNAME>\Application\Data\Macromedia\Flash Player\#SharedObjects\<RANDOM>\<DOMAINNAME> When you drill down in each domain’s directory, you will eventually find a “SOL” file.
    [Show full text]
  • Home Java Plugin Detector Java (Using <Applet> And/Or <Object> Tag
    22/05/12 Java plugin detection with PluginDetect Home Java Plugin Detector Java (using <applet> and/or <object> tag) installed & enabled: true Highest Installed Java Version: 1,6,0,31 Java 1,6,0,10 or higher (using <applet> and/or <object> tag) is installed & enabled. Java detection: completed ON THE FLY (OTF) Deployment Toolkit browser plugin installed & enabled: false Next-Generation Java Plugin2 installed & enabled: true Java vendor: Sun Microsystems Inc. Java plugin name: Java(TM) Platform SE 6 U31 Java plugin description: Next Generation Java Plug-in 1.6.0_31 for Mozilla browsers navigator.javaEnabled(): true [This detector is capable of OTF & NOTF Java detection. Detection occurs before window.onload event has fired.] [window.onload event has fired successfully.] [ The plugin detector(s) in this web page use the following: PluginDetect_Java.js, detectJava_OTF_NOTF.js, getJavaInfo.jar ] Download PluginDetect and the jarfile here... In order to do Java detection, you will need 2 things: 1) download the getJavaInfo.jar applet along with a few Java detection examples. The jarfile (Java ARchive file) is used by PluginDetect in order to accomplish Java detection. 2) download the PluginDetect script itself. The PluginDetect script generator will allow you to customize the PluginDetect script to include whatever features you desire. That being said, I would still recommend that you read thru most of this page before creating your own Java detection code. A brief introduction to Java detection PluginDetect uses a number of different methods when trying to detect Java in your browser. These Java detection methods can be divided into 2 groups: a) the non-applet methods and b) the applet methods.
    [Show full text]
  • Protokoly Pro Komunikaci Klient ˚U Na Platformˇe Flash
    MASARYKOVA UNIVERZITA F}w¡¢£¤¥¦§¨ AKULTA INFORMATIKY !"#$%&'()+,-./012345<yA| Protokoly pro komunikaci klient ˚una platformˇeFlash BAKALÁRSKA PRÁCA Tomáš Mizerák Brno, jar 2010 Prehlásenie Prehlasujem, že táto bakalárska práca je mojím pôvodným autorským dielom, ktoré som vypracoval samostatne. Všetky zdroje, pramene a literatúru, ktoré som pri vypracovaní používal alebo z nich ˇcerpal,v práci riadne citujem s uvedením úplného odkazu na prís- lušný zdroj. Vedúci práce: RNDr. David Šafránek, Ph.D. ii Pod’akovanie Dakujemˇ svojmu vedúcemu bakalárskej práce RNDr. Davidovi Šafránkovi, Ph.D. za pomoc, ochotu a strpenie, ktoré mi venoval pri tvorbe tejto práce. Taktiež d’akujem svojej rodine za podporu poˇcascelého štúdia a všetkým, ktorí mi akýmkol’vek spôsobom pomohli pri spracovaní tejto bakalárskej práce. iii Zhrnutie Vd’aka vysokej rozšírenosti technológie Flash a výkonu dnešných poˇcítaˇcovmôžeme im- plementovat’ aplikácie a hry bez nutnosti inštalácie. Táto práca zh´rˇnaspôsoby komunikácie klientov Flash a prehl’ad dostupných protokolov. V rámci práce boli jednoduchým nástro- jom otestované dva najrozšírenejšie protokoly pre Flash – HTTP a RTMP. Súˇcast’ou práce je ukážková aplikácia využívajúca RTMP pre spojenie klient-server a RTMFP pre peer-to-peer komunikáciu. iv Abstract Because of the great expansion of Flash technology and thanks to the performance of mod- ern computers we’re able to implement applications and games without the necessity of installing them. This thesis includes various possibilities of communication between Flash clients and an overview of available protocols. As a part of this thesis two most common protocols for Flash – HTTP and RTMP – were tested by a simple custom tool. The practical part is a demo application which uses RTMP for a client-server and RTMFP for peer-to-peer communication.
    [Show full text]